Skip to content

Commit acaae8f

Browse files
nefeldtnefeldt
authored
add pki functions and token creation (#32)
Signed-off-by: Noah Feldt <[email protected]>
1 parent a52111b commit acaae8f

File tree

2 files changed

+230
-3
lines changed

2 files changed

+230
-3
lines changed

‎authentication.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
package vault
2+
3+
type Authentication struct {
4+
Service
5+
}
6+
7+
func (c *Client) Authentication() *Authentication {
8+
return c.AuthenticationWithMountPoint("auth")
9+
}
10+
11+
func (c *Client) AuthenticationWithMountPoint(mountPoint string) *Authentication {
12+
return &Authentication{
13+
Service: Service{
14+
client: c,
15+
MountPoint: mountPoint,
16+
},
17+
}
18+
}
19+
20+
type AuthCreateTokenRequest struct {
21+
RoleName string `json:"role_name,omitempty"`
22+
ID string `json:"id,omitempty"`
23+
Policies []string `json:"policies,omitempty"`
24+
Meta map[string]interface{} `json:"meta,omitempty"`
25+
NoParent bool `json:"no_parent,omitempty"`
26+
NoDefaultPolicy bool `json:"no_default_policy,omitempty"`
27+
Renewable bool `json:"renewable,omitempty"`
28+
TTL int `json:"ttl,omitempty"`
29+
Type string `json:"type,omitempty"`
30+
EntityAlias string `json:"entity_alias,omitempty"`
31+
}
32+
33+
type AuthCreateTokenResponse struct {
34+
RequestID string `json:"request_id"`
35+
LeaseID string `json:"lease_id"`
36+
Renewable bool `json:"renewable"`
37+
LeaseDuration int `json:"lease_duration"`
38+
Data interface{} `json:"data"`
39+
WrapInfo interface{} `json:"wrap_info"`
40+
Warnings []string `json:"warnings"`
41+
Auth struct {
42+
ClientToken string `json:"client_token"`
43+
Accessor string `json:"accessor"`
44+
Policies []string `json:"policies"`
45+
TokenPolicies []string `json:"token_policies"`
46+
Metadata interface{} `json:"metadata"`
47+
LeaseDuration int `json:"lease_duration"`
48+
Renewable bool `json:"renewable"`
49+
EntityID string `json:"entity_id"`
50+
TokenType string `json:"token_type"`
51+
Orphan bool `json:"orphan"`
52+
NumUses int `json:"num_uses"`
53+
} `json:"auth"`
54+
MountType string `json:"mount_type"`
55+
}
56+
57+
func (k *Authentication) CreateOrphanToken(pkiopts AuthCreateTokenRequest) (*AuthCreateTokenResponse, error) {
58+
response := &AuthCreateTokenResponse{}
59+
err := k.client.Write(
60+
[]string{
61+
"v1",
62+
k.MountPoint,
63+
"token",
64+
"create-orphan",
65+
}, pkiopts, response, nil,
66+
)
67+
if err != nil {
68+
return nil, err
69+
}
70+
71+
return response, nil
72+
}

‎pki.go‎

Lines changed: 158 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ func (k *PKI) Issue(role string, pkiopts PKIIssueOptions) (*PKIIssueResponse, er
5656

5757
type PKIGenerateIntermediateOptions struct {
5858
CommonName string `json:"common_name"`
59-
KeyName string `json:"key_name"`
59+
KeyName string `json:"key_name,omitempty"`
6060
AltNames string `json:"alt_names,omitempty"`
6161
Format string `json:"format,omitempty"`
6262
PrivateKeyFormat string `json:"private_key_format,omitempty"`
@@ -100,6 +100,7 @@ type PKISignIntermediateOptions struct {
100100
Format string `json:"format,omitempty"`
101101
KeyUsage string `json:"key_usage,omitempty"`
102102
UseCSRValues bool `json:"use_csr_values,omitempty"`
103+
NotAfter string `json:"not_after,omitempty"`
103104
}
104105

105106
type PKISignIntermediateResponse struct {
@@ -117,13 +118,111 @@ type PKISignIntermediateResponse struct {
117118

118119
func (k *PKI) SignIntermediate(issuerRef string, pkiopts PKISignIntermediateOptions) (*PKISignIntermediateResponse, error) {
119120
response := &PKISignIntermediateResponse{}
121+
path := []string{"v1", k.MountPoint}
122+
123+
if issuerRef == "" {
124+
path = append(path, "root", "sign-intermediate")
125+
} else {
126+
path = append(path, "issuer", issuerRef, "sign-intermediate")
127+
}
128+
129+
err := k.client.Write(path, pkiopts, response, nil)
130+
if err != nil {
131+
return nil, err
132+
}
133+
134+
return response, nil
135+
}
136+
137+
type PKIImportCABundleRequest struct {
138+
PemBundle string `json:"pem_bundle"`
139+
}
140+
type PKIImportCABundleResponse struct {
141+
Data struct {
142+
ImportedIssuers []string `json:"imported_issuers"`
143+
ImportedKeys []string `json:"imported_keys"`
144+
Mapping map[string]string `json:"mapping"`
145+
ExistingIssuers []string `json:"existing_issuers"`
146+
ExistingKeys []string `json:"existing_keys"`
147+
} `json:"data"`
148+
}
149+
150+
func (k *PKI) ImportCaOrPrivateKey(pkiopts PKIImportCABundleRequest) (*PKIImportCABundleResponse, error) {
151+
response := &PKIImportCABundleResponse{}
152+
err := k.client.Write(
153+
[]string{
154+
"v1",
155+
k.MountPoint,
156+
"issuers",
157+
"import",
158+
"bundle",
159+
}, pkiopts, response, nil,
160+
)
161+
if err != nil {
162+
return nil, err
163+
}
164+
165+
return response, nil
166+
}
167+
168+
type PKIListIssuersResponse struct {
169+
Data struct {
170+
KeyInfo map[string]struct {
171+
IssuerName string `json:"issuer_name"`
172+
} `json:"key_info"`
173+
Keys []string `json:"keys"`
174+
} `json:"data"`
175+
}
176+
177+
func (k *PKI) ListIssuers() (*PKIListIssuersResponse, error) {
178+
response := &PKIListIssuersResponse{}
179+
err := k.client.List(
180+
[]string{
181+
"v1",
182+
k.MountPoint,
183+
"issuers",
184+
}, nil, response, nil,
185+
)
186+
if err != nil {
187+
return nil, err
188+
}
189+
190+
return response, nil
191+
}
192+
193+
type PKIUpdateIssuerRequest struct {
194+
IssuerName string `json:"issuer_name"`
195+
LeafNotAfterBehavior string `json:"leaf_not_after_behavior,omitempty"`
196+
ManualChain []string `json:"manual_chain,omitempty"`
197+
Usage []string `json:"usage,omitempty"`
198+
}
199+
200+
type PKIUpdateIssuerResponse struct {
201+
Data struct {
202+
CACertificateChain []string `json:"ca_chain"`
203+
Certificate string `json:"certificate"`
204+
IssuerID string `json:"issuer_id"`
205+
IssuerName string `json:"issuer_name"`
206+
KeyID string `json:"key_id"`
207+
LeafNotAfterBehavior string `json:"leaf_not_after_behavior"`
208+
ManualChain interface{} `json:"manual_chain"`
209+
Usage string `json:"usage"`
210+
RevocationSignatureAlgorithm string `json:"revocation_signature_algorithm"`
211+
IssuingCertificates []string `json:"issuing_certificates"`
212+
CRLDistributionPoints []string `json:"crl_distribution_points"`
213+
DeltaCRLDistributionPoints []string `json:"delta_crl_distribution_points"`
214+
OCSPServers []string `json:"ocsp_servers"`
215+
} `json:"data"`
216+
}
217+
218+
func (k *PKI) UpdateIssuer(issuerName string, pkiopts PKIUpdateIssuerRequest) (*PKIUpdateIssuerResponse, error) {
219+
response := &PKIUpdateIssuerResponse{}
120220
err := k.client.Write(
121221
[]string{
122222
"v1",
123223
k.MountPoint,
124224
"issuer",
125-
issuerRef,
126-
"sign-intermediate",
225+
issuerName,
127226
}, pkiopts, response, nil,
128227
)
129228
if err != nil {
@@ -132,3 +231,59 @@ func (k *PKI) SignIntermediate(issuerRef string, pkiopts PKISignIntermediateOpti
132231

133232
return response, nil
134233
}
234+
235+
type PKIReadIssuerResponse struct {
236+
Data struct {
237+
CACertificateChain []string `json:"ca_chain"`
238+
Certificate string `json:"certificate"`
239+
RevocationTime int `json:"revocation_time"`
240+
} `json:"data"`
241+
}
242+
243+
func (k *PKI) ReadIssuer(issuerName string) (*PKIReadIssuerResponse, error) {
244+
response := &PKIReadIssuerResponse{}
245+
err := k.client.Read(
246+
[]string{
247+
"v1",
248+
k.MountPoint,
249+
"issuer",
250+
issuerName,
251+
"json",
252+
}, response, nil,
253+
)
254+
if err != nil {
255+
return nil, err
256+
}
257+
258+
return response, nil
259+
}
260+
261+
type PKIRevokeIssuerResponse struct {
262+
CAChain []string `json:"ca_chain"`
263+
Certificate string `json:"certificate"`
264+
IssuerID string `json:"issuer_id"`
265+
IssuerName string "json:\"issuer_name\""
266+
KeyID string `json:"key_id"`
267+
LeafNotAfterBehavior string `json:"leaf_not_after_behavior"`
268+
ManualChain interface{} `json:"manual_chain"`
269+
Usage string `json:"usage"`
270+
RevocationTime int64 `json:"revocation_time"`
271+
}
272+
273+
func (k *PKI) RevokeIssuer(issuerName string) (*PKIRevokeIssuerResponse, error) {
274+
response := &PKIRevokeIssuerResponse{}
275+
err := k.client.Write(
276+
[]string{
277+
"v1",
278+
k.MountPoint,
279+
"issuer",
280+
issuerName,
281+
"revoke",
282+
}, nil, response, nil,
283+
)
284+
if err != nil {
285+
return nil, err
286+
}
287+
288+
return response, nil
289+
}

0 commit comments

Comments
 (0)